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ICO call for views on a data protection and 
journalism code of practice 


The Information Commissioner is calling for views on a data 
protection and journalism code of practice (the code). 


The Data Protection Act 2018 requires the Commissioner to produce 
a code of practice that provides practical guidance and promotes 
good practice in regard to processing personal data for the purposes 
of journalism. Our intention is for the code to provide practical, 
pragmatic guidance for journalists on how to comply with data 
protection legislation, building on the detailed guidance that we 
have already produced for this sector. 


This call for views is the first stage of the consultation process. The 
Commissioner is seeking input from relevant stakeholders, including 
media organisations, trade associations, data subjects and those 
representing the interests of data subjects. For further information 
on the call for views, please read our blog post here. 


We will use the responses we receive to inform our work in 
developing the code. 


You can email your response to journalismcode@ico.org.uk. 


Or print and post to: 


Journalism Code Call for Views 
Policy & Engagement Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


The call for views will be open until Monday 27th May 2019. 
Privacy statement 


For this consultation we will publish all responses except for those 
where the respondent indicates that they are an individual acting in 
a private capacity (e.g. a member of the public). All responses from 
organisations and individuals responding in a professional capacity 
(e.g. academics, freelance journalists, sole traders, legal 
professionals) will be published. We will remove email addresses 


Journalism Code of Practice - Call for views 
20190429 v1.0 


Information Commissioner's Office 


and telephone numbers from these responses but apart from this 
we will publish them in full. 


For more information about what we do with personal data please 
see our privacy notice. 


uestions 


Qi Weare considering using our current guidance "Data 


protection and journalism: a guide for the media” as the basis 
on which we will build the new journalism code. Do you agree 


or disagree with this approach? 


Agree - but see below 


[| ] Disagree 


Q2 If you disagree, please explain why? 


In broad terms I think that the Data Protection and Journalism Guidance is a 
reasonable place in which to start. However, it is critical to recognise the 
differences between the Code required under the Data Protection Act 2018 and 
the previous guidance. In particular: (i) The code must comprehensively cover 
processing for the purposes of journalism. It cannot therefore appear limited 
to the “media” as many including actors including individuals do engage in 
journalistic activities, almost invariably online. (ii) It explicitly must ensure 
“good practice” in relation to the processing of personal data. This must 
include compliance with other laws which seek to protect individuals in relation 
to the processing of certain types of personal data, namely, defamation law and 
the tort of the misuse of private information. Neither are mentioned in the 
current guidance. (iii) Unlike the current guidance which “does not have any 
formal legal status” (p. 3), it will need to be taken into account by courts, 
tribunals and the ICO itself when carrying out its regulatory functions (see s. 
127). As the ICO has itself noted, this includes the periodic statutory review 
required under section 178. The Code therefore must be drafted in more 
precise and specific terms which enable it perform this legal and regulatory 
role. 


Q3 "Data protection and journalism: a guide for the media” is 
split into three sections: 


- “Practical guidance” aimed at anyone working in the 
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journalism sector; 


- “Technical guidance” aimed at data protection practitioners 
within media organisations; and 


- “Disputes”, aimed at senior editors and staff responsible for 
data protection compliance. 


Do you think we should retain this structure for the code? 


C] ves 
No 


Q4 If no, do you have any suggestions about how we should 
structure the code? 


There is certainly a need for a layered and contextual approach to the Code. 
However, most of the core building-blocks of the Code should have some 
relevance to anyone processing for journalistic purposes. The current approach 
rather gives the impression that whole swathes of the guidance only need to be 
looked at by certain specialised actors. A better approach might be develop a 
layered approach within each of the building-blocks, possibly with an initial 
summary at the start. The key building blocks could be (i) scope, (ii) standards 
- possibly split into default provisions and criteria for exemption, (iii) processes 
- which must clearly be highly contextual given that appropriate processes for 
a large media organisation will be extremely different from that of a sole 
individual, (iv) Supervision and dispute resolution. 


Q5 Do you think the ICO’s existing guidance for journalists 
addresses the main areas where data protection issues 
commonly arise? 


LJ Agree 
Disagree 


Q6 If no, what additional areas would you like to see covered? 


One important issue which is not addressed in the current guidance concerns 
the responsibility for online comments which may be facilitated by journalistic 
organisations such as ‘below-the-line’ comment sections. These forums can be 
an important site for public discourse but can also include some of the most 
troubling content from a data protection point of view. This area involves a 
complex interface between statutory data protection law, statutory e- 
Commerce Regulations and competing human rights (protected in the Human 


Journalism Code of Practice - Call for views 
20190429 v1.0 


ico. 


Information Commissioner's Office 


Rights Act and the EU Charter). In this context, it is notable that in a line of 
cases beginning with C-131/12 Google Spain the Court of Justice has sought to 
lay out the responsibilities of different actors which may in combination be 
responsible for data protection outcomes. Moreover, in C-346/17 Buivids the 
Court held in relation to an amateur individual that publishing “on a video 
website [YouTube] on which users can send, watch and share videos, without 
restricting access to that video, thereby permitting access to personal data to 
an indefinite number of people” could not (as the ICO has suggested) be 
categorically excluded on the purported basis of the domestic or household 
exemption but needed to be assessed from the perspective of the data 
protection framework as a whole. The ICO therefore needs to take 
responsibility for developing proportionate standards here (including 
appropriate exemption from technical aspects such as impact assessments and 
requirements to ‘register’ with ICO) and also ensure an appropriate 
apportioning of responsibility between the different actors (e.g. the 
organisational website, the user). 


A related tricky issue concerns the online archiving of not just this but other 
sensitive content and the dissemination of it to other online actors such as 
search engines. The existing guidance rightly argues that online archives do 
fall within the derogations for journalism (p. 13). However, it needs to be 
emphasised that the public interest and incompatibility tests as well as the 
interface with other law need to be contextualised to this particular context. 
There is need for specific guidance as to how to address claims the various data 
protection issues that may arise, for example, finding content that was initially 
illegally published ab initio, finding material that is likely inaccurate, ensuring 
that the timeliness or otherwise of the material is clear (e.g. by prominently 
displaying the date on which it last updated etc.). 


The Code also needs to specify in more detail the relationship between 
statutory supervision through the ICO and other mechanisms of co- or self- 
regulation (p. 47). Codes of practice continue to be partially addressed but 
only as regards the public interest test in Sch. 2 of the Data Protection Act 
2018. However, this issue has added salience now that the GDPR itself has put 
in place default criteria for codes of conduct (art. 40) and monitoring bodies 
(art. 41). The last aspect provide criteria for assessing how the ICO might 
assess Self- and co-regulatory processes. 


Q7 The journalism code will address changes in data protection 
law, including developments in relevant case law. Are there 
any particular changes to data protection law that you think 
we should focus on in the code? 


There are quite a lot of changes both in case law and legislation which need to 
be taken into account of in the new Code. 


Turning to legislation, it is clearly important to address the specific changes in 
the statutory regime applicable to journalism including changes to data 
protection criminal offences, the introduction of reasonable belief defences in 
relation to these, reforms in the detail of ICO enforcement powers in relation to 
journalism and the special regime for reviewing journalism’s compliance with 
data protection. There are also some important changes introduced by the 
GDPR including provisions concerning codes of conduct and monitoring bodies 
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(art. 40-41) and requirements for impact assessments (art. 35). The former 
set down default criteria for assessing mechanisms which operate at arms- 
length from ICO supervision namely (i) independent and expertise, (ii) 
monitoring and periodic review of controllers, (iii) transparent systems for 
handling complaints, and (iv) effective management of conflicts of interest. 
These criteria are in principle as applicable to the supervision of journalism as 
they are to other activities. The latter GDPR provision on impact assessment 
could potential play some role in journalism. However, the ICO’s current 
approach to its threshold for its engagement hasn’t been thought through fully 
here and would appear to be manifestly overbroad in the journalistic context. 
Much the same could be said for the provisions which ICO has participated in 
concerning requirements to register (and pay a charge) to the ICO. There isa 
need to ensure that any such technicalities not only serve the purposes of the 
legislation but can apply contextually across the entire area regulated as 
journalism under the GDPR in a manner which is not disproportionate. Such a 
proportionality standard is required by the European Convention, EU Charter 
and Human Rights Act. 


Turning case law the following judgments are of particular note: 

- Delphi v Estonia (2015) (Application no. 64569/09) - a Grand Chamber 
judgment from the European Court of Human Rights which explored the 
interface between article 8 and article 10 of the European Convention in 
relation to user-generated content on news websites. Subsequent case 
law from the Court has further explored this vexing issue. 

- Moulay v Elaph Publishing [2017] EWCA Civ 29 - an important Court of 
Appeal judgment which confirmed the close connection in individual 
reputation cases between defamation law and data protection law. 
Writing for the entire court, Mr Justice Dingemans stated that “J can see 
no good reason of principle why a claim under the DPA cannot be linked 
to a defamation claim, and why it should not be added by amendment if 
the test for amendment is otherwise met”. Earlier cases had already 
similarly highlighted a close connection between data protection and the 
misuse of private information in individual privacy- see e.g. Weller v 
Associated Newspapers [2014)] EWHC 1163. 


- C-345/17 Buivids (2019) (C:2019:122) - a recent judgment of Court of 
Justice which again interpreted the scope of data protection extremely 
broadly, holding that there could be no categorical exemption of 
indeterminate publication by amateur individuals on the purported basis 
of the personal or household exemption and furthermore that as regards 
a YouTube video recording “the fact that such a recording was made on 
only one occasion has no bearing on the issue of whether that operation 
comes within the scope” of data protection (at [36]). Not only is the 
ICO’s Data Protection Directive guidance in this area (see 
https://ico.org.uk/media/for-organisations/documents/1600/social- 
networking-and-online-forums-dpa-quidance.pdf, p. 15) clearly not 
consistent with the Court’s approach but this judgment highlights the 
need to ensure that the journalistic derogation works at national level in 
a way which can be proportionality and contextually applied to a wide 
range of situations well outside of the institutional media. 


Q8 Apart from recent changes to data protection law, are there 
any other developments that are having an impact on 
journalism that you think we should address in the code? 
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Yes. It is explicit that the Code must promote good practice in addition to 
requirements of the data protection law. This must include following other 
applicable laws which protect individuals in relation certain types of personal 
information processing, notably defamation law and the misuse of private 
information. The current Guidance makes no mention of these other laws 
despite the fact that they are at least indirectly integrated into data protection 
through the default requirement to process data “lawfully”. Case law since 
2014 has stressed the close connection between data protection, defamation 
law and the misuse of private information. All these causes of action seek to 
protect the personality rights of individuals as regards the flow of information. 
These interrelationships should, therefore, not be ignored in the new Code. 


Q9 Are there any case studies or journalism scenarios that you 
would like to see included in the journalism code? 


As suggested above, it would be useful to have more a case study addressing 
the interrelationship between the data protection provisions applicable to 
journalism and news archives. 


Q10 Do you have any other suggestions for the journalism code? 


by Parliament) it is important that this Code is promoted to all relevant actors. 
A layered or targeted approach is likely to be necessary given the very wide 
range of actors to whom the Code will have relevance e.g. the institutional 
media, freelance journalists, citizen journalists, the legal community and the 
general public. Where relevant this guidance should be promoted alongside 
other activities in relation to journalism e.g. the requirement on the ICO to 
publish guidance on redress mechanisms against media organisations (s. 177) 
and the periodic review of journalism’s compliance with data protection (s. 
178). 


It is important also to address how the Code will be kept under review as 
required by s. 126(3) of the DPA 2018. This is particularly important given that 
case law may quite radically change the situation here. For example, the 
outcome of C-687/18 SY v Associated Newspapers could lead to pre-publication 
injunctive relief being available directly under data protection (as it already is in 
certain circumstances under the misuse of private information). 


The Leveson Inquiry recommended that the ICO include regular updates in its 
annual report addressing its work to ensure the effectiveness of data protection 
in the area of the Press. This recommendation would seem equally applicable 
to other types of journalistic activity and has added salience in the context of 
the new Code and other provisions included in the DPA 2018 which add up to 
quite a wide-ranging role for the ICO in this area. It would be valuable, 
therefore, to include a periodic analysis of the implementation of Code and the 
other related journalism initiatives in each Annual Report. This could be 
addition to periodic reviews of the Code (e.g. following the end of the first 
review of journalism under s. 178) and any necessary updates following major 
developments in case law. 


A few indirectly relevant points come to mind. Once produced (and approved 
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About you 


p 


O DORI 


Are you answering these questions as? 

A media organisation? 

A trade association? 

An organisation representing the interests of data subjects? 
An academic? 

An individual acting in a professional capacity? 

An organisation that regulates press standards? 


An individual acting in a private capacity (e.g. someone 


providing their views as a member of the public)? 


Other? 


If you answered ‘other’ please specify: 


Q12 How did you find out about this survey? 


Ea) | 


Q13 


ICO website 

Social media 
Conference/seminar 
Trade/professional association 
Media 

Word of mouth 

Other? 


We may want to contact you about some of the points you 
have raised. If you are happy for us to do this please provide 
your email address: 
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Thank you for taking the time to share your views and experience. 
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